download

Network Configuration—FirewallsAccording to FreeBSD's CVS commits history, FreeBSD has had built-in firewallcapability since 1994. Obviously, the built-in firewall has improved a lot to meettoday's needs. There are two main firewall technologies available in FreeBSD7—IPFW and PF, each of which offers almost similar functionalities, but withdifferent rule-set syntax.IPFW is a FreeBSD firewall utility which has been in the source tree since 1994. Itoffers basic firewall capabilities such as stateless and stateful packet inspection, aswell as DUMMYNET pipes, ALTQ for traffic shaping, and DIVERT sockets.PF is a new firewall utility ported from the OpenBSD project, back in 2003. PF is afull-featured firewall utility with optional QoS support using ALTQ framework.This chapter will explain the basic and intermediate setup and configuration of bothIPFW and PF. IPFW and PF are both in active development and more features will beadded later. There are plenty of valuable resources, on both these powerful firewallprograms, available on the internet.In this chapter, we will look into the following:• Packet filtering with IPFW• Packet filtering with PF• Network address translation.